CVE-2026-78380 in RansomLook
Summary
by MITRE • 08/24/2026
RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which the post belongs is configured as private.
As a result, newly parsed victim information associated with a private group or market may be automatically published through enabled Rocket.Chat, Mastodon, Bluesky, and e-mail notification channels despite the entity being explicitly configured to prevent public disclosure.
A similar issue affects the public MISP feed. The feed previously determined privacy using groupinfo(), which only queries the group database. Consequently, victim information associated with private markets could be added to the public MISP feed because the corresponding market privacy flag was not evaluated.
An attacker or other unauthorized party able to access these public notification channels or the MISP feed may obtain victim information that was intended to remain private. Depending on the collected data, this may disclose victim names, ransomware activity, incident information, or other information associated with privately monitored groups and markets.
The fix introduces a common is_private_entity() check covering both groups and markets and prevents private entity posts from being distributed through external notification channels or the public MISP feed. Internal storage and dashboard alerting remain unaffected.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/24/2026
RansomLook, a platform dedicated to monitoring ransomware activity by aggregating victim data from various threat actor groups and underground markets, suffered from a critical logic flaw in its post-processing pipeline that resulted in the unauthorized disclosure of sensitive information. The vulnerability stemmed from an incomplete verification process when distributing newly collected victim posts to external notification channels such as Rocket.Chat, Mastodon, Bluesky, and email services. While the system correctly checked whether individual data entries were marked as private by their authors or collectors, it failed to verify the privacy status of the parent group or market entity itself. This oversight meant that if a ransomware group or underground marketplace was explicitly configured with a private setting intended to restrict public access, posts associated with that entity could still be automatically published through enabled notification channels. The root cause lies in the architectural decision to treat individual post metadata independently from the broader context of the source entity's configuration settings.
The impact of this vulnerability extends beyond simple notification leaks, as it also affected the platform's integration with the Malware Information Sharing Platform (MISP). RansomLook provides a public MISP feed that allows security organizations and threat intelligence analysts to ingest data about ongoing ransomware campaigns. Previously, the logic determining whether victim information should be included in this public feed relied on a function called groupinfo(), which queried only the group database without evaluating the specific privacy flags associated with markets or groups. Consequently, victim information linked to private markets was inadvertently added to the public MISP feed. This exposure allows attackers and unauthorized parties who monitor these channels to access detailed victim data that was explicitly intended to remain confidential. The disclosed information can include victim names, specifics of ransomware activity, incident timelines, and other operational details associated with privately monitored groups and markets.
From a security classification perspective, this vulnerability aligns with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, as the system failed to properly restrict access to data based on defined privacy policies. Furthermore, it relates to CWE-798: Use of Hard-coded Credentials or Fixed Keys if one considers the rigid application logic that ignored dynamic configuration states, though more accurately it represents a failure in Access Control enforcement due to incomplete context evaluation. In terms of MITRE ATT&CK mapping, this flaw facilitates Reconnaissance activities for threat actors by providing them with detailed intelligence on victim organizations and their security posture through public feeds and social media channels. The exposure of such data can aid attackers in conducting targeted phishing campaigns or verifying the success of ongoing extortion efforts against specific entities.
The remediation strategy implemented to address this issue involves introducing a comprehensive is_private_entity() check that covers both groups and markets within the post-processing logic. This unified verification ensures that any content associated with an entity marked as private is strictly prevented from being distributed through external notification channels or included in the public MISP feed. It is important to note that while external distribution was restricted, internal storage mechanisms and dashboard alerting features remain unaffected by this change, ensuring that authorized administrators can still access the data for legitimate investigative purposes within secure environments. This fix restores the integrity of privacy controls defined at the entity level, preventing accidental leaks caused by oversights in hierarchical context verification during automated dissemination processes.